"Add to This Rule" versus "Add to Exiting rule"

cmartin_60 — Thu, 07 Apr 2022 21:28:59 GMT

Hi Guys,

I tried to find out what is the difference between "Add to This Rule" versus "Add to Exiting rule" in a security policy.

Thanks

Re: "Add to This Rule" versus "Add to Exiting rule"

BPry — Thu, 07 Apr 2022 23:23:35 GMT

@cmartin_60,

Assuming that you're talking about policy optimization on the "Apps Seen" tab, it means what you would expect. The Add to This Rule option will add the app specified to the rule that captured the traffic initially, while the Add to Existing Rule will add the application into a different entry that already exists in your rulebase.

As an example, if you have any sort of "catch-all" rule present to identify traffic, you'd likely never want to "Add to This Rule" since it would completely break the purpose of the rule; instead you would either "Add to Existing Rule" (say if you want to add it to some sort of "allowed applications" rule or something like that), or you would "Create Cloned Rule" to create a new entry and not break the "catch-all" entry.

Re: "Add to This Rule" versus "Add to Exiting rule"

nevolex — Sat, 22 Apr 2023 07:17:55 GMT

I find it confusing, wouldn't it be easier to say: 'add to this rule' and "add to other rule" instead?

topic Re: "Add to This Rule" versus "Add to Exiting rule" in General Topics

"Add to This Rule" versus "Add to Exiting rule"

Re: "Add to This Rule" versus "Add to Exiting rule"

Re: "Add to This Rule" versus "Add to Exiting rule"